4be5eb2191071fdf496ff4df7a570d03dc9114190df1614c0a18465a48a8079d

Analysis

max time kernel
0s
max time network
127s
platform
debian-9_armhf
resource
debian9-armhf-20221111-en
resource tags

arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
06/01/2023, 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.rsync/c/run
Size

489B
MD5

97a962fb5bd427e09547ecaaf850e034
SHA1

3040ea8bc3226af1fc201c4fefcca17b62184bbe
SHA256

5a1797ae845e8c80c771ece9174b93ad5d5a74e593fe3b508ba105830db5fd92
SHA512

2ed6bad217478913a053fbcad37c904dddacee424ce39115c15019477870582b0d53da908783047cf9069df0a011387b3fba336385ff392ab0be84cd49d04001

Score

9^/10

antivm

Malware Config

Signatures

Attempts to identify hypervisor via CPU configuration 1 TTPs 1 IoCs

Checks CPU information for indicators that the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
/proc/cpuinfo	/proc/cpuinfo	cat

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/.rsync/c/run	/tmp/.rsync/c/run	run

/tmp/.rsync/c/run
/tmp/.rsync/c/run
1⤵
- Writes file to tmp directory
PID:353
- /bin/uname
  uname -m
  2⤵
  PID:363
- /usr/bin/nohup
  nohup ./go
  2⤵
  PID:364
- ./go
  ./go
  2⤵
  PID:364

/bin/grep
grep model
1⤵
PID:356

/bin/cat
cat /proc/cpuinfo
1⤵
- Attempts to identify hypervisor via CPU configuration
PID:355

/bin/grep
grep name
1⤵
PID:357

/usr/bin/wc
wc -l
1⤵
PID:358

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads